Compliance risk detection method and apparatus, electronic device, and storage medium

Abstract

The embodiment of the application provides a compliance risk detection method and device, electronic equipment and storage medium, applied to the field of artificial intelligence technology, the internal correlation between business data and regulation data can be explored by establishing a knowledge graph, by inputting the risk feature data extracted from the knowledge graph into the pre-trained machine learning model, the pre-trained machine learning model can output the risk assessment result corresponding to the to-be-detected object based on the internal correlation between the business data and the regulation data, which can reduce the dependence on the professional ability of the compliance personnel, thereby reducing the influence of individual differences on the evaluation efficiency and accuracy in the compliance risk detection process, making the detection of the to-be-detected object more objective, and through the above process, the automatic detection of the compliance risk is also realized, the artificial cost in the compliance risk detection process is reduced, and the detection efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to compliance risk detection methods, devices, electronic equipment, and storage media. Background Technology

[0002] With the continuous development of technology and the continuous improvement of laws and regulations, the internet, healthcare, finance and other fields all need to conduct business operations in accordance with the basic laws and industry norms of their respective fields.

[0003] In existing technologies, identifying corporate compliance risks through manual assessment requires professional privacy compliance personnel to evaluate the compliance risks of the company's business based on regulatory templates. This process relies entirely on the professional capabilities of privacy compliance personnel, and the efficiency and accuracy of the assessment are greatly affected by individual differences. Summary of the Invention

[0004] The purpose of this application is to provide a compliance risk detection method, apparatus, electronic device, and storage medium to reduce the impact of individual differences on the assessment efficiency and accuracy during the compliance risk detection process. The specific technical solution is as follows:

[0005] Firstly, embodiments of this application provide a compliance risk detection method, the method comprising:

[0006] Obtain the business data of the object to be tested and the regulatory data related to the business of the object to be tested; the business data is the data related to the object to be tested during the processing of the business of the object to be tested; the regulatory data is the legal documents and / or regulations that need to be met when processing the business of the object to be tested.

[0007] A knowledge graph is generated based on the business data and the regulatory data, wherein the knowledge graph represents the relationship between the business data and the regulatory data;

[0008] Feature extraction is performed on the knowledge graph to obtain risk feature data, which is data in the knowledge graph that can characterize the risks existing in the business data;

[0009] The risk feature data is input into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

[0010] Secondly, embodiments of this application provide a compliance risk detection device, which includes:

[0011] The data acquisition module is used to acquire the business data of the object to be tested and the regulatory data related to the business of the object to be tested; the business data is the data related to the object to be tested during the processing of the business of the object to be tested; the regulatory data is the legal documents and / or regulations that need to be met when processing the business of the object to be tested.

[0012] The knowledge graph generation module is used to generate a knowledge graph based on the business data and the regulatory data, wherein the knowledge graph represents the relationship between the business data and the regulatory data;

[0013] The feature extraction module is used to extract features from the knowledge graph to obtain risk feature data, wherein the risk feature data is data in the knowledge graph that can characterize the risks existing in the business data;

[0014] The risk prediction module is used to input the risk feature data into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

[0015] Thirdly, embodiments of this application provide an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs; and the processor is used to implement any of the compliance risk detection methods described in this application when executing the programs stored in the memory.

[0016] Fourthly, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the compliance risk detection methods described in this application.

[0017] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute any of the compliance risk detection methods described in this application.

[0018] The compliance risk detection method, apparatus, electronic device, and storage medium provided in this application first acquire the business data of the object to be detected and the regulatory data related to the business of the object to be detected; then, based on the business data and regulatory data, a knowledge graph is generated, and features are extracted from the knowledge graph to obtain risk feature data, which is data in the knowledge graph that can characterize the risks existing in the business data; finally, the risk feature data is input into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected. By establishing a knowledge graph, the inherent relationship between business data and regulatory data can be discovered. By inputting the risk feature data extracted from the knowledge graph into a pre-trained machine learning model, the pre-trained machine learning model can output a risk assessment result corresponding to the object to be detected based on the inherent relationship between the business data and regulatory data. This reduces the reliance on the professional capabilities of compliance personnel, thereby reducing the impact of individual differences on the assessment efficiency and accuracy in the compliance risk detection process, making the detection of the object to be detected more objective. Furthermore, through the above process, automatic detection of compliance risks is also achieved, reducing the manual cost in the compliance risk detection process and improving detection efficiency. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0020] Figure 1 This is a flowchart illustrating the compliance risk detection method in the embodiments of this application;

[0021] Figure 2 This is a schematic diagram of the process for generating a knowledge graph in an embodiment of this application;

[0022] Figure 3 This is a schematic diagram illustrating the process of correcting the risk score in an embodiment of this application;

[0023] Figure 4 This is a schematic diagram illustrating the process of training a machine learning model in an embodiment of this application;

[0024] Figure 5 This is a schematic diagram of the process for generating suggested strategies in an embodiment of this application;

[0025] Figure 6 This is a schematic diagram of the process of updating the knowledge graph in an embodiment of this application;

[0026] Figure 7 This is a flowchart illustrating the second implementation method of the compliance risk detection method in this application.

[0027] Figure 8This is a schematic diagram illustrating the process of generating a knowledge graph and extracting features in an embodiment of this application.

[0028] Figure 9 This is a schematic diagram illustrating the interactions between the various sub-modules in the embodiments of this application;

[0029] Figure 10 This is a flowchart illustrating the output of the strategy list in an embodiment of this application;

[0030] Figure 11 This is a schematic diagram of the compliance risk detection device in the embodiments of this application;

[0031] Figure 12 This is a schematic diagram of the structure of the electronic device in the embodiments of this application. Detailed Implementation

[0032] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0033] Enterprise compliance risk detection in related technologies mainly includes two modes: one is a standardized assessment mode driven by humans, and the other is a semi-automated assessment mode assisted by tools.

[0034] Currently, the most widely used testing method by enterprises is the manual, standardized assessment model, which requires professional privacy compliance personnel to conduct tests on the enterprise's business in accordance with regulatory templates. The core advantage of this model is that it can combine business experience to handle special scenarios, but it relies entirely on the professional capabilities of personnel, and its efficiency and accuracy are greatly affected by individual differences.

[0035] In the tool-assisted semi-automated assessment model, automation of some steps is achieved through privacy management tools. First, sensitive fields (such as ID card numbers, mobile phone numbers, etc.) are automatically identified through database connection tools. Based on the data type of the sensitive fields, relevant legal provisions are matched in the legal database using keywords of "data type + processing behavior". Then, risk levels are output based on preset thresholds according to fixed scoring rules (such as "processing biometric data = high risk" and "local encrypted storage = risk downgraded by 1 level"). However, the essence of this model is still "the coded implementation of manual rules". Artificial intelligence technology is only used in the data extraction stage and does not touch the core "risk prediction" and "strategy recommendation" stages of Privacy Impact Assessment (PIA), and cannot cope with dynamic and complex business scenarios.

[0036] The two detection modes in the related technologies have four defects, all of which stem from the inherent contradiction between "human dependence" and "static logic," as follows:

[0037] 1. The evaluation process is inefficient and cannot adapt to large-scale dynamic business operations.

[0038] Problem Description: Manual evaluation of a single scenario takes an average of 1-2 weeks. If cross-departmental data flows are involved (such as the linkage of "payment + logistics + marketing" data in e-commerce), it is necessary to coordinate information from multiple teams, including technology, business, and legal, which can extend the cycle to more than 1 month. Although semi-automated tools can reduce document work by 30%-50%, key information still needs to be extracted manually when dealing with unstructured data. Statistics from an internet company show that 80% of its working hours are spent on sorting out unstructured data.

[0039] Cause analysis: First, the "concealment" of data processing activities—implicit data calls in business code (such as data acquisition from unregistered third-party interfaces) and sensitive data transmission records in logs require professional personnel to verify line by line; Second, the "semantic barrier" of unstructured data—vague statements in privacy policies (such as "share data when necessary") and user authorization information in customer service recordings—traditional tools lack the ability to understand natural language and parse logic, and cannot automatically convert them into evaluation criteria.

[0040] 2. Risk assessment is delayed, turning it into a tool for "post-event compliance".

[0041] Problem Manifestations: The relevant technologies are all "post-launch assessments". For example, a financial application added an "overseas server data backup" function. One week after launch, it was discovered through PIA that the cross-border transmission filing obligation had not been fulfilled. 500,000 backed-up user data records needed to be deleted, which triggered user complaints and regulatory inquiries. Even the "real-time monitoring" function of semi-automated tools can only trigger alarms after a risk occurs (such as the plaintext transmission of sensitive data), and cannot predict risks in advance.

[0042] Root cause analysis: The core problem lies in the "static" nature of the assessment logic. Traditional PIA is based on "business snapshots" for assessment, treating data processing activities as fixed processes and failing to perceive dynamic changes in business (such as adding data processing nodes or expanding the data transmission range). The rule engine of semi-automated tools relies on manually preset thresholds and cannot learn the evolution of risks through historical data, resulting in risk identification always lagging behind business actions.

[0043] 3. The risk scoring is rigid and cannot accurately match the actual risks.

[0044] Problem Description: The relevant technologies use a "single-dimensional fixed rule" scoring method, such as "processing ID card numbers is judged as high risk," but fail to consider the differences in scenarios. For example, the risk exposure probability and severity of "processing ID card numbers" are completely different for "government platforms using it for identity verification (encrypted storage + access audit)" and "e-commerce platforms using it for member registration (plaintext storage + no access control)." A uniform scoring method leads to "false high-risk judgments" or "false low-risk judgments."

[0045] Cause analysis: Lack of "multi-dimensional scenario-based risk modeling" capability - related technologies only focus on the single dimension of "data type" and do not integrate multi-dimensional features such as "processing purpose, transmission range, security measures, and regulatory requirements"; at the same time, machine learning algorithms are not introduced to explore the correlation patterns in historical risk cases, resulting in the scoring failing to reflect the complexity and dynamism of actual risks.

[0046] To address at least one of the aforementioned problems, embodiments of this application provide a compliance risk detection method. The method includes: acquiring business data of an object to be detected and regulatory data related to the business of the object to be detected; the business data being data related to the object to be detected during the processing of its business; the regulatory data being legal documents and / or regulations required to be met when processing the business of the object to be detected; generating a knowledge graph based on the business data and the regulatory data, wherein the knowledge graph represents the relationship between the business data and the regulatory data; extracting features from the knowledge graph to obtain risk feature data, wherein the risk feature data is data in the knowledge graph that can characterize the risks present in the business data; and inputting the risk feature data into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

[0047] In this embodiment, a knowledge graph can be established to uncover the inherent relationship between business data and regulatory data. By inputting the risk feature data extracted from the knowledge graph into a pre-trained machine learning model, the model can output a risk assessment result for the target based on the inherent relationship between the business data and regulatory data. This reduces reliance on the professional capabilities of compliance personnel, thereby reducing the impact of individual differences on assessment efficiency and accuracy during compliance risk detection. This makes the detection of the target more objective. Furthermore, the above process also enables automatic detection of compliance risks, reducing manual costs and improving detection efficiency.

[0048] The compliance risk detection method of the application embodiments is described in detail below.

[0049] The compliance risk detection method described in this application focuses on the entire personal information processing chain and is applicable to all scenarios requiring PIA (Personal Information Authority) obligations. It performs exceptionally well in scenarios involving highly sensitive data processing and complex business architectures, particularly for scenarios with mixed data types, dynamically changing processing activities (frequent new features / third-party collaborations), and ambiguous compliance boundaries (multiple regulations applicable simultaneously). Its effectiveness is significantly superior to existing technologies. Specific application scenarios include, but are not limited to: 1. Financial sector: monitoring credit card transaction data flows, cross-institutional sharing of credit approval data, and modeling of user behavior data for intelligent investment advisors. 2. Healthcare sector: cross-hospital access to electronic medical records, data storage for gene testing, and application of biometric (facial / fingerprint) data in remote diagnosis and treatment. 3. Internet platforms: interaction between e-commerce user consumption data and third-party data, data collection for content recommendation on short video platforms, and verification of the implementation of privacy policies on social media software. 4. Government and enterprise services sector: verification of ID card / household registration information on government service platforms, aggregation of sensor data in smart cities, and cross-border transmission of employee information.

[0050] See Figure 1 The compliance risk detection method provided in this application embodiment may include:

[0051] S101, Obtain the business data of the object to be tested and the regulatory data related to the business of the object to be tested.

[0052] The business data refers to the data related to the object under test during the processing of its business; the regulatory data refers to the legal documents and / or regulations that need to be met when processing the business of the object under test.

[0053] The entities to be tested are enterprises or organizations requiring PIA (Publicity Authority) verification. Regulatory data related to the business operations of the entity to be tested can be obtained based on the business type or the industry type of the entity. For example, global compliance regulations can be collected within minutes using web crawlers, regulatory application programming interfaces (APIs), and web hooks, and then the regulatory data relevant to the entity's business can be selected. The regulatory data in this application may include laws and regulations of various regions, as well as relevant privacy policies and other regulatory documents. The business data of the entity to be tested may include its business code, business logs, database data, etc., which can be selected according to the actual situation.

[0054] S102, Generate a knowledge graph based on the business data and the regulatory data.

[0055] A knowledge graph represents the relationships between business data and regulatory data. Specifically, a knowledge graph can include the relationships between regulatory entities and business data entities. A business data entity refers to a specific piece of data within a business, such as "biometric data" or "ID card number"; a regulatory entity refers to a specific regulation, such as Article 1, Article 2, or Rule 3. In one example, a large language model can be used to establish the relationships between business data and regulatory data, thereby obtaining a knowledge graph.

[0056] S103, feature extraction is performed on the above knowledge graph to obtain risk feature data.

[0057] The risk characteristic data refers to data in the knowledge graph that can characterize the risks present in the business data. For example, the risk characteristic data may be: unencrypted, weakly encrypted, exceeding regulatory requirements, unauthorized, implicitly authorized, etc.

[0058] In some examples, when extracting risk feature data from a knowledge graph, the corresponding type of risk feature data can be extracted according to a preset feature type. This preset feature type refers to the feature type that impacts compliance risk, and can be customized according to actual circumstances. As shown in Table 1, a sample preset feature type may include the following: sensitivity level, data volume, data type, transmission scope, storage period, encryption status, access control, regulatory compliance, user authorization status, industry type, business purpose, historical risk records, encryption method, and access control.

[0059] In some examples, corresponding extraction methods can be set for different feature types. This allows risk feature data of that feature type to be extracted from the knowledge graph according to the extraction method corresponding to that feature type. The extraction methods for different feature types can be as shown in Table 1. The extraction methods shown in Table 1 are merely illustrative examples; specific extraction methods can be customized according to actual circumstances. No limitations are imposed on the extraction methods here.

[0060] In some other examples, the feature data corresponding to each dimension can be combined into risk feature data according to a preset dimensional order. The preset dimensional order can be customized according to actual conditions, and is not specifically limited in this application. For example, the dimensions here may include: data attributes, processing attributes, compliance attributes, and scenario / historical attributes.

[0061] The preset feature types shown in Table 1 below can cover all dimensions of risk impact. The definitions, extraction rules, and quantification standards of the preset feature types are shown in Table 1.

[0062] Table 1

[0063] It is understood that the preset feature type definitions, extraction rules and quantification standards shown in Table 1 are for illustrative purposes only, and the actual definitions, extraction and quantification standards can be set according to the application scenario.

[0064] S104, the risk feature data is input into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

[0065] The machine learning model here can be any type of machine learning model, such as a convolutional neural network model, a decision tree model, etc. This machine learning model can be pre-trained using risk feature data samples and manually labeled risk feature data samples with risk assessment result labels.

[0066] In this embodiment, a machine learning model is used as the core of intelligence to break the limitations of traditional PIA, which is "manually driven and statically isolated". The privacy impact assessment is transformed from "human experience judgment" into an intelligent task that is "machine-computable, learnable and iterative". By using a machine learning model to predict the risk assessment results, the automatic detection of compliance risks is realized, reducing the manual cost in the compliance risk detection process and improving the detection efficiency.

[0067] In some examples, the aforementioned business data may include structured and unstructured data. The unstructured data typically contains business codes. Therefore, in step S102, based on the aforementioned business data and regulatory data, and building upon the generation of the knowledge graph, this application also provides a possible implementation for generating the knowledge graph. See [link to relevant documentation]. Figure 2 The process includes:

[0068] S1021, the business code is converted into an abstract syntax tree. The abstract syntax tree includes multiple data processing link entities.

[0069] S1022, Identify the data processing link entities of the abstract syntax tree to obtain the first entity relationship.

[0070] Wherein, the first entity relationship represents the association between the first data entity and the processing entity in the business code, and the processing entity represents the entity name of the method of processing the first data entity.

[0071] In one example, business logic code can be converted into an Abstract Syntax Tree (AST) using a Low Level Virtual Machine (LLVM). Converting business logic code into an AST is an existing technology and will not be described in detail here.

[0072] In some examples, the "variable definition → method call → data storage" nodes of the AST can be traversed to identify multiple data processing chain entities included in the abstract syntax tree, thereby obtaining the first entity relationship. For example, by marking "card_no" as a sensitive field and associating it with the "unencrypted storage" processing entity in the code, the first entity relationship is output as: bank_card_no (data) - processing entity → unencrypted storage (processing).

[0073] S1023, Perform entity recognition on the structured business data to obtain the second data entity in the structured business data;

[0074] Structured business data can include database tables, logs, etc. In one example, based on a preset schema dictionary (covering 12 types of sensitive data, such as the regular expression "^\d{17}[\dXx]$" corresponding to ID card numbers), the second data entity of a data entity can be automatically marked, that is, the sensitivity level (high / medium / low). For example: output: user_id_card (field) - sensitivity level → high (attribute).

[0075] S1024, perform data entity identification and entity relationship extraction on the regulatory data to obtain a second entity relationship, wherein the second entity relationship represents the association between the third data entity of the regulatory data and the regulatory entity; the regulatory entity is an entity term representing the regulatory requirement;

[0076] In one example, the second entity relationship, besides data entities and regulatory entities, can also include security measures, where security measures represent the processing methods stipulated by regulations. Automatic extraction of the second entity relationship can be achieved based on Neuro-Linguistic Programming (NLP). In one example, a Bidirectional Encoder Representations from Transformers (BERT) model is used to implement Named Entity Recognition (NER), thereby obtaining the third data entity, such as identifying "biometric data" (data entity) and "regulation XXXX" (regulatory entity). A relation extraction model (e.g., a segmented convolutional neural network) is then used to extract relations such as "requirement" and "prohibition," for example: Regulation XXXX (regulatory entity) - Requirement → Encryption of transmission (security measure). In another example, to increase the scenario applicability of the BERT model, it can be fine-tuned in the privacy domain. A Chinese BERT model (bert-base-chinese) is fine-tuned using training data of 100,000 privacy policies and 80,000 regulatory provisions.

[0077] S1025, Based on the second data entity, the first entity relationship, and the second entity relationship, establish a knowledge graph representing the association relationship between the second data entity, the processing entity, and the regulatory entity.

[0078] The knowledge graph contains three core node types: "Data Entities" (attributes: ID, name, sensitivity level, data volume), "Processing Entities" (attributes: ID, behavior type, encryption status, transmission scope), and "Legal Entities" (attributes: ID, legal name, clause content, validity level). Additionally, it may include "Security Measures" nodes. Relationships between nodes support four types: "Processing," "Requirement," "Association," and "Conflict." For example: ID number (data entity) - Processing → Cross-border transmission (processing entity) - Association → Legal provision XXXXX (legal entity) - Requirement → Filing (security measure).

[0079] In this embodiment, business data and regulatory data are transformed into a structured knowledge graph linking "data entities - processing entities - regulatory entities," providing a feature carrier for dynamic scoring. Through LLVM code parsing and BERT-NER processing technologies, the entire data chain of "database tables + business code + regulations" can be automatically organized, replacing 80% of the manual basic data organization work and achieving automated processing of all types of data. For example, after e-commerce customers access the platform, the system can complete the automated graph drawing of "user payment data flow + third-party data calls" within 2 hours, while the traditional manual method would take a week, greatly increasing data processing efficiency. Furthermore, this embodiment allows for the simultaneous processing of structured and unstructured data, further improving processing efficiency.

[0080] In some examples, the risk assessment results described above may include risk type and risk level. Therefore, after inputting the risk feature data into a pre-trained machine learning model, the risk type and risk score output by the pre-trained machine learning model can be obtained.

[0081] In one example, two different machine learning models can be used. The first outputs the risk type of the object to be detected, and the second outputs the risk level. The first machine learning model can be trained using risk feature data samples and manually labeled risk type tags from these samples, while the second model can be trained using the same risk feature data samples and their corresponding risk level tags. In another example, the above machine learning model is a dual-task model, which can simultaneously output both the risk type and risk level of the object to be detected. This dual-task model can be trained using risk feature data samples and their corresponding risk type and risk level tags. The risk type can be set according to the actual situation; in one example, the risk type could include unauthorized collection, sensitive data leakage, cross-border violations, and expired storage.

[0082] In some examples, when the aforementioned machine learning model is a dual-task model, it may include a shared feature layer, a classification task head, and a regression task head. In this case, risk feature data can first be input into the machine learning model. The shared feature layer extracts features from this risk feature data to obtain shared feature data. Then, the classification task head processes this shared feature data to obtain the risk type of the object to be detected. The regression task head processes this shared feature data to obtain a risk score for the object to be detected. Finally, the risk level can be obtained from this risk score.

[0083] In some examples, the risk type and risk level of the object to be detected are related to the number of business risks detected. For example, when both "transmitting ID card numbers in plaintext" and "transmitting medical record data in encrypted form" are detected at the same time, the risk level can be output as: Level 5, risk type: sensitive data leakage (corresponding to "transmitting ID card numbers in plaintext"); and Level 2, risk type: sensitive data leakage (corresponding to "transmitting medical record data in encrypted form").

[0084] In some examples, the risk score can be further revised to obtain the risk level of the object under test. In other examples, the risk score can be revised based on the industry type of the object under test; for example, different industry types correspond to different revision parameters. The revised risk score is then used as the risk level of the object under test, employing the corresponding revision parameters. See [link to relevant documentation] for more details. Figure 3 The method may include:

[0085] S1041, Based on the preset correspondence between industry correction coefficients and industry types, determine the first industry correction coefficient for the industry in which the object to be tested belongs. The industry correction coefficient is a preset coefficient used to correct the risk level of different types of industries.

[0086] Specifically, a corresponding industry correction coefficient can be set in advance for each industry type. The higher the sensitivity of an industry type, the higher the scenario correction coefficient corresponding to that industry type. For example, the medical industry = 1.2, the financial industry = 1.1, the e-commerce industry = 1.0, and the government industry = 1.3. The specific values ​​can be set according to the actual situation, and no specific limitation is made in this application.

[0087] In this way, the first industry correction factor of the industry in which the object to be tested belongs can be determined based on the corresponding industry correction factor set in advance for each industry type.

[0088] S1042, Based on the preset correspondence between processing entities and processing entity correction values, determine the first processing entity correction value corresponding to the processing entity in the knowledge graph; the processing entity correction value represents the correction value for correcting the risk score when the processing method corresponding to the processing entity is used for processing.

[0089] The processing entity represents the processing method of the data entity, such as "encryption using an encryption algorithm", "access auditing", "no measures taken", etc. A corresponding processing entity correction value can be pre-set for each processing entity. The greater the risk generated by the processing entity, the larger the corresponding processing entity correction value. For example, the correction value for a processing entity that uses an encryption algorithm for encryption is -0.8, the correction value for a processing entity that implements access auditing is -0.5, and the correction value for a processing entity that takes no measures is 0. The specific values ​​can be set according to the actual situation, and are not specifically limited in this application.

[0090] By pre-setting corresponding processing entity correction values ​​for each processing entity, the first processing entity correction value corresponding to the processing entity in the knowledge graph can be determined.

[0091] S1043, the risk score of the object to be detected is corrected using the first industry correction coefficient and the first processing entity correction value to obtain the risk level of the object to be detected.

[0092] The industry adjustment factor can be used as a product factor for the risk score. Adding the treatment entity adjustment value to this factor will then correct the risk score. For example, assuming a risk score range of 0-10, the risk level is calculated as: Risk Level = round((Risk Score × Industry Adjustment Factor + Treatment Entity Adjustment Value) / 2), where round() is the rounding function.

[0093] Specifically, taking the scenario of "cross-border transmission of medical record data" on a certain medical platform as an example, the risk score is 8.2, the industry correction coefficient is 1.2, and the processing entity correction value is -1.0. Therefore, the calculated risk level is: (8.2×1.2-1.0) / 2=(9.84-1.0) / 2=4.42, round(4.42)=4, that is, the risk level is level 4. At the same time, the risk type output by the machine learning model is "cross-border violation + sensitive data leakage".

[0094] In this embodiment, a dual-task machine learning model can simultaneously obtain both risk type and risk level, saving computational costs compared to obtaining risk type and risk level separately using two machine learning models. Furthermore, the risk level is obtained by correcting the risk score using industry correction coefficients and processing entity correction values. The assessment of risk level also considers industry type and processing entity, linking the risk level to industry type and data processing method, fully taking into account industry differences and increasing the accuracy of risk level determination. This avoids the functional defect of traditional models that "only have risk level without type," enabling the output of "risk type + risk level" in a single inference, improving assessment efficiency by over 60%, and achieving a joint assessment accuracy of 90%.

[0095] See in some examples Figure 4 The above machine learning model was trained using the following method:

[0096] Step A1: Obtain risk characteristic data samples, risk type labels, and risk score labels for the aforementioned risk characteristic data samples.

[0097] The dimensions of the risk feature data samples are the same as those of the risk feature data in step S103 above. Risk type labels and risk score labels can be obtained manually.

[0098] Step A2: Input the above-mentioned risk feature data samples into the machine learning model, and extract features from the risk feature data through the above-mentioned shared feature layer to obtain sample shared feature data.

[0099] In one example, the machine learning model can be a Lightweight Gradient Boosting Machine (LightGBM) model, configured with classification and regression task heads to build a dual-task learning architecture. The classification task head outputs the "risk type" (classification), and the regression task head outputs the "risk score" (regression), addressing the "single-function" problem of traditional models. The model parameters of the LightGBM model can be set according to the actual training scenario. In one example, the LightGBM model parameters are set as follows: learning rate = 0.05, tree depth = 6, and number of leaf nodes = 31. Figure 4 As shown, risk feature data samples are input into LightGBM. LightGBM's shared feature layer extracts and selects features from the risk feature data samples, and the resulting features are called sample shared feature data.

[0100] Step A3: Process the shared feature data of the above samples using the classification task head to obtain the predicted risk type.

[0101] The classification task head processes the shared feature data of the samples to obtain the probability of each preset risk type, and outputs the preset risk type with the highest probability as the predicted risk type. The preset risk types can be set according to the actual situation. In one example, the preset risk types can include unauthorized collection, sensitive data leakage, cross-border violations, and storage expiration.

[0102] Step A4: Calculate the cross-entropy loss between the above-mentioned risk type label and the above-mentioned predicted risk type to obtain the first loss.

[0103] Based on the risk type label and the predicted risk type, the cross-entropy loss is calculated using the cross-entropy loss function as the first loss. Figure 4 (In this context, L1 is used). In one example, the regularization coefficient of the cross-entropy loss function can be set to 0.1 to reduce model overfitting.

[0104] Step A5: Process the shared feature data of the above samples using the regression task head to obtain the predicted risk score.

[0105] The regression task head performs regression processing on the shared feature data of the samples to obtain a predicted risk score. In one example, the predicted risk score can range from 0 to 10, with a higher score indicating a more severe risk. In another example, the predicted risk score can be the feature weights of multiple dimensions and the weighted sum of the feature values. These feature weights are pre-set based on different dimensions.

[0106] Step A6: Calculate the mean squared error loss between the above risk score label and the above predicted risk score to obtain the second loss.

[0107] Based on the risk score labels and predicted risk scores, the mean squared loss is calculated using the mean squared loss function as the second loss. Figure 4 (In this context, L2 is used). In one example, the regularization coefficient of the mean squared error loss function can be set to 0.2 to reduce model overfitting.

[0108] Step A7: Calculate the model loss by combining the first loss and the second loss, and adjust the parameters of the machine learning model based on the model loss.

[0109] The first loss and the second loss can be weighted and summed, and the sum can be used as the total loss, i.e., the model loss in this training process. In one example, the model loss = L1 + 0.8 × L2. The parameters of LightGBM are then adjusted based on the model loss.

[0110] Repeat the above training process until the model loss converges or the preset number of training iterations are reached, thus obtaining the trained machine learning model.

[0111] Besides offline training, another example is the use of "offline pre-training + incremental fine-tuning" to train the machine learning model. Offline pre-training is iterated for 100 rounds, stopping when the validation set accuracy is ≥92% and the mean absolute error is ≤0.3. Incremental fine-tuning is performed once for every 10,000 new data points. Using this "offline pre-training + incremental fine-tuning" method, the machine learning model achieves an F1 score ≥0.91 for the classification task head, a mean absolute error ≤0.25 for the regression task head, and a joint evaluation metric of ≥90% of samples with a scoring error ≤0.5 and matching risk type, meeting practical application requirements.

[0112] When the use case changes or new use cases are added, offline retraining of the model is required, which increases training costs and affects the model's deployment time. In one example, this application uses the FTRL (Follow The Regularized Leader) online learning algorithm to update the machine learning model parameters online, ensuring that the score follows business changes. The update trigger mechanism can be periodic, such as updating based on incremental data received hourly; or event-triggered, such as when the business scenario changes (e.g., new third-party cooperation, regulatory updates). During online learning, the machine learning model parameters are configured as follows: learning rate = 0.01, regularization coefficient of cross-entropy loss function = 0.05, regularization coefficient of mean squared error loss function = 0.1, batch update sample size = 50, parameter update latency ≤ 30 seconds. The machine learning model parameter update process includes: calculating the loss gradient of the current sample; updating the leaf node weights of the decision tree using the FTRL formula; validating the updated parameters through A / B testing (the error between the risk score output under the new parameters and the manually labeled risk score ≤ 0.3), and replacing the online model after successful validation.

[0113] Compared to traditional stochastic gradient descent, this embodiment employs the FTRL algorithm, which converges faster in sparse feature scenarios. Parameter updates require only incremental data, eliminating the need for full retraining. The machine learning model response latency is ≤500ms, saving training costs while allowing the machine learning model to be updated online without user awareness, without needing to be taken offline. It not only completes single PIA tasks but also improves assessment accuracy and strategy adaptability through data accumulation, aligning with the dynamic development characteristics of digital businesses. Based on the FTRL online learning mechanism, risk scoring can be triggered in real-time for new business additions (such as cross-border data cooperation and the launch of biometric functions), updating risk levels and pushing alerts hourly. For example, when a financial customer adds the "overseas server backup" function, the system can immediately identify the risk of "unregistered cross-border transmission," outputting a level 4 score and compliance rectification prompts. This enables real-time monitoring of dynamic risks, reducing the likelihood of risks materializing.

[0114] In addition to generating risk types and risk levels, it can also provide users with suggested strategies. Therefore, in Figure 1 Based on the compliance risk detection method shown, this application also provides a possible implementation method, see [link to implementation details]. Figure 5 The compliance risk detection method may also include:

[0115] S105, Based on the preset correspondence between risk types and risk handling rules, determine the risk handling rules corresponding to the risk type of the object to be detected.

[0116] In some examples, a pre-defined mapping between risk types and risk handling rules can be established, allowing the generation of risk handling rules corresponding to each risk type. Alternatively, business rule tools can be used to derive the risk handling rules for each risk type. For instance, Drools (an open-source business rule engine) can be used to convert regulatory clauses into "if-or" risk handling rules. For example, if the risk type is cross-border transfer and the regulation is Article 1, then the risk handling rule must include "cross-border filing," and the rule base is updated with new regulations every 7 days.

[0117] S106, Based on the risk handling rules corresponding to the risk type of the object to be detected, the risk type, and the risk level, a suggested strategy is generated using a preset intelligent agent. The suggested strategy is a recommended approach for the risk type corresponding to the object to be detected, and includes a processing entity and legal basis.

[0118] In some examples, a pre-defined agent is used to generate suggested strategies. These strategies include the entities to be processed and the legal basis, and may also include estimated costs, which can be customized according to actual needs. Combining reinforcement learning with a business rule engine, adapted suggested strategies can be output based on the enterprise's technology stack and cost budget. In one example, the pre-defined agent is based on Proximal Policy Optimization (PPO). The PPO reinforcement learning configuration is as follows: Agent state: dynamic score, risk type, enterprise technology stack, cost budget (RMB 10,000 / year). Action space: includes specific strategies such as "encryption algorithm selection," "access control scheme," and "filing process." Training iteration: iterates once every 1000 new policy feedback data points, with a reward function convergence threshold ≥ 8.5 points. Output: a pre-formatted policy list, including "policy name, implementation steps, technology selection, cost estimate, and compliance basis."

[0119] In one example, the output of the preset intelligent agent could be: strategy_id:S20251208001; risk_type: cross-border violation + sensitive data leakage; risk_score:4; strategies:name: cross-border filing; steps:1. Log in to the XXX Data Protection Bureau website;2. Submit a data transmission impact assessment report;3. Obtain the filing number; reference: Article 1; cost:0 (free); name: medical record data encryption; steps:1. Deploy the XXX encryption gateway;2. Encrypt existing medical records in batches;3. Configure transmission encryption rules; tech:XXXX encryption module; cost:15 (ten thousand yuan / year); name: access audit; steps:1. Enable account activity audit service;2. Configure audit log retention for 1 year;3. Set abnormal access alarms; tech: account activity audit service; cost:3 (ten thousand yuan / year).

[0120] In this embodiment, a knowledge graph is used as the data hub, a machine learning model as the intelligence core, and reinforcement learning as the strategy engine. This breaks through the limitations of traditional PIA (Privacy Impact Assessment) which is "manually driven and statically isolated," constructing a full-process AI-driven system of "automatic data parsing - dynamic risk assessment - adaptive strategy recommendation." It transforms privacy impact assessment from "human experience-based judgment" into an intelligent task that is "machine-computable, learnable, and iterative." It can provide suggested strategies based on risk type and risk level, thereby helping users reduce risk. Furthermore, it supports the automatic generation of standardized PIA reports: the tool can automatically generate PIA reports based on risk assessment results and a strategy list, supporting one-click report export. Consultants only need to add 5% of special business explanations, reducing the report production time from 3 days to 4 hours.

[0121] To improve the accuracy of the recommended strategy, it can be adjusted based on feedback data. In one possible implementation, see [link to relevant documentation]. Figure 6 The process of updating the recommended strategy may include:

[0122] S601, Obtain feedback data for the suggested strategy.

[0123] The feedback data includes a risk level change value and a strategy effectiveness score. The risk level change value is the difference between the risk score of the object under test before implementing the suggested strategy and the risk score after implementing the suggested strategy. The strategy effectiveness score is calculated based on the risk level change value and the total number of pre-divided risk levels.

[0124] In some examples, the feedback data mentioned above includes a risk level change value and a strategy effectiveness score. The risk level change value is the difference between the risk score of the object under test before implementing the recommended strategy and the risk score after implementing the recommended strategy. Strategy effectiveness indicates whether the recommended strategy is effective. Strategy effectiveness can include effective, ineffective, or partially effective. Therefore, the strategy effectiveness score can be represented by a number between 0 and 1, for example, 0 indicates ineffective, 1 indicates effective, 0.5 indicates half effective, etc. In one example, the feedback data can also include a cost deviation rate, where cost deviation rate = (actual cost - estimated cost) ÷ estimated cost. Specifically, performance and cost data can be obtained by connecting to the user enterprise's operation and maintenance platform. The collected indicators include: business performance impact (e.g., response latency), actual cost, etc. "Compliance rate" and "strategy effectiveness" are obtained by compliance personnel. The risk score after implementing the recommended strategy can be obtained using the business data after implementing the recommended strategy through the compliance risk detection method in this application. The final feedback data can include: recommended strategy identifier, risk level change value, strategy effectiveness score, cost deviation rate, and other fields.

[0125] In one example, the effectiveness of the recommended strategy can be evaluated by combining knowledge graphs to quantify the actual effect of the customer's existing security investments. For instance, after a customer deploys a firewall, by comparing the changes in risk scores before and after deployment (e.g., from level 4 to level 1), an evaluation report can be generated stating that "the firewall mitigates cross-border transmission risks by 75%", providing a basis for adjusting the customer's security budget.

[0126] S602, update the reward function correction value of the preset agent according to the policy effectiveness score, wherein the reward function correction value is a value representing the correction of the reward of the preset agent; the higher the policy effectiveness score, the larger the reward function correction value.

[0127] In some examples, the "policy effectiveness score" is used as a correction factor for the reward function of the pre-defined agent; for example, an effective policy is rewarded by +1, and an ineffective policy is rewarded by -2.

[0128] S603, update the feature weights of the target features in the machine learning model according to the risk level change value, wherein the target features are the features corresponding to the processing entity of the suggested strategy.

[0129] In some examples, the "risk level change value" in the feedback data is used as a new label to update the feature weights in the regression task head of the machine learning model using the FTRL algorithm. For example, the negative weight of a feature like "encryption" is increased by 0.2. Employing the FTRL algorithm, model parameters are updated in real-time every hour based on incremental feature data, eliminating the need for full retraining. Parameter update latency is ≤30 seconds, and model response latency is ≤500ms. Updates are proactively triggered by changes in business scenarios (such as adding third-party collaborations). This addresses the lag issue of traditional "post-launch assessment," enabling proactive risk prediction and real-time monitoring, and preventing user complaints and regulatory penalties arising from risks such as unregistered cross-border data transfers.

[0130] S604, based on the effectiveness score of the strategy, add nodes of the entities processed in the proposed strategy to the knowledge graph, and update the weights of the nodes corresponding to the legal basis of the proposed strategy in the knowledge graph.

[0131] For example, the new "processing entity - regulatory entity" relationship can be imported into the knowledge graph, such as adding "encryption - compliance with Article 1" to the knowledge graph. Furthermore, the weights of the regulatory entity nodes corresponding to the regulatory basis can be updated; for example, the weight of the regulatory entity node associated with the effective policy can be increased by 0.1.

[0132] Steps S602 to S604 can be executed according to a preset cycle (e.g., once a week in full) or triggered immediately when there is an emergency regulatory update, both of which are within the scope of protection of this application.

[0133] In this embodiment, updating the knowledge graph, machine learning model, and pre-set intelligent agent using feedback data can make the knowledge graph more complete and the predictions of the machine learning model more accurate, thereby achieving continuous improvement in accuracy. This transforms "human-led assessment" into "tool-assisted precision service," expanding the boundaries of consulting services. Through a feedback iteration mechanism, compliance cases and suggested strategies from different industries such as finance, healthcare, and government can be accumulated, forming a company-exclusive "compliance solution knowledge base." This allows for providing newly acquired clients with "ID card information verification compliance," including mature solutions such as encryption standards and authorization processes, improving the standardization and delivery speed of consulting services.

[0134] In one example, this application embodiment also provides another compliance risk detection method, see [link to relevant documentation]. Figure 7 The method may include:

[0135] Step 1: Multi-source data collection and standardization.

[0136] The system connects to the database of the target object via a database connection interface to collect database table structure (field names, data types, sensitive identifiers) and interface logs (including request parameters, transmission addresses, and encryption identifiers). It also collects operational data (server storage permissions, data transmission bandwidth) using Prometheus (a cloud-native monitoring software for monitoring and collecting data from software and systems). Furthermore, it retrieves business code via an application programming interface, parses privacy policy documents using a parsing tool, converts customer service recordings into text data using an audio recognition application, and periodically scrapes regulatory texts from various official websites using web crawling technology.

[0137] We employ Change Data Capture (CDC) technology to achieve real-time incremental collection of structured data, while unstructured data is collected using a combination of incremental and full data collection (incremental collection of code every hour, full collection of documents every day), ensuring data latency is ≤1 minute. We collect three core types of data through multiple source interfaces: data streams (database tables, logs), processing activities (business code, operation and maintenance records), and regulatory requirements (domestic and international privacy regulations texts), breaking through the limitation of traditional tools that "only process structured data".

[0138] All data is converted to JavaScript Object Notation (JSON) format, and is required to include five header fields: "data identifier, type, source, timestamp, and MD5 checksum". A three-stage processing method is employed: null value filtering (removing fields with a missing value rate ≥30%), noise cleaning (using WebRTC algorithm for audio recording noise reduction), and deduplication (MD5 checksum). The output data has a purity ≥99.6%.

[0139] When preset trigger conditions are met, such as incremental data ≥ 500MB, or every hour, the standardized dataset is automatically pushed to step 2.

[0140] Step 2: Multimodal analysis and knowledge graph construction.

[0141] Standardized data is transformed into a structured knowledge graph that links "data entities, processing entities, and regulatory entities," providing a feature carrier for dynamic scoring.

[0142] For example Figure 8As shown, the code parsing submodule converts business code into an AST using LLVM, and traverses the nodes of the AST to obtain the association between data entities and processing entities. The text parsing submodule performs NER using the BERT model and extracts relationships using a relation extraction model to obtain the association between data entities and regulatory entities. The structured mapping submodule identifies sensitive data fields by matching schema dictionaries and marks the sensitivity level of each sensitive data field (data entity). The knowledge graph construction submodule generates a knowledge graph from the data output by the code parsing, text parsing, and structured mapping submodules. The knowledge graph is stored in the Neo4j graph database, with node indexes built based on "entity type + name," and a query response time of ≤100ms.

[0143] Step 3: The artificial intelligence outputs the risk level and risk type.

[0144] The risk type and risk level are output using a machine learning model. Step 3 specifically includes steps 3.1, 3.2, 3.3, and 3.4.

[0145] Step 3.1, multi-dimensional feature engineering.

[0146] For example Figure 9 As shown, the feature engineering submodule can obtain entity and relationship data from the knowledge graph and perform feature extraction of preset feature types to obtain multi-dimensional risk feature data. The feature engineering submodule sends the risk feature data to the dual-task model submodule. Specifically, the risk feature data can be in the form of feature vectors.

[0147] Step 3.2, dual-task machine learning model training and inference.

[0148] For example Figure 9 As shown, the dual-task model submodule can train a dual-task machine learning model based on risk feature data, manually labeled risk score tags, and risk type tags. The dual-task model submodule is also used to generate risk types and risk levels using the dual-task machine learning model and send them to the score calculation submodule.

[0149] Step 3.3, FTRL online parameter update.

[0150] For example Figure 9 As shown, the online learning submodule updates the dual-task machine learning model online using the FTRL algorithm based on model parameters and real-time data. The online learning submodule then sends the updated parameters to the scoring calculation submodule.

[0151] Step 3.4, Risk level calculation.

[0152] For example Figure 9As shown, the scoring calculation submodule determines the industry correction coefficient and the processing entity correction value based on the updated parameters; the risk score is then corrected using the industry correction coefficient and the processing entity correction value to obtain the risk level.

[0153] Step 4: Recommendation of strategies and compliance verification.

[0154] Based on dynamic scoring and risk type, an actionable strategy of "compliance + low cost" is generated, for example. Figure 10 The input includes risk level, risk type, and enterprise attributes (including enterprise technology stack). The business rule engine selects the risk handling rule corresponding to the risk type. The risk handling rule is sent to a pre-defined agent, which generates candidate strategies based on the risk handling rule, enterprise technology stack, and cost factors. The strategy evaluation submodule calculates the compliance score and cost score of the candidate strategies. The pre-defined agent iteratively optimizes the candidate strategies based on the compliance score and cost score until the reward function is maximized, adding the current candidate strategy to the strategy list. Violating strategies are removed from the strategy list according to the risk handling rule, and the remaining strategies in the strategy list are output as suggested strategies.

[0155] The business rules engine can transform domestic and international privacy regulations into enforceable risk handling rules (such as "children's data must be authorized by their guardians" and "biometric data storage shall not exceed 6 months"), forming a "prohibition list" and "mandatory requirements" for policy recommendations, ensuring that recommended strategies do not cross compliance red lines. A reinforcement learning environment is constructed with "policy execution effectiveness" as its objective. A pre-defined intelligent agent serves as the policy generator, and the environment is a business scenario (inputting enterprise technology stack / cost budget / industry attributes). The reward function design includes "compliance score and business cost score," where the compliance score is calculated by the business rules engine called by the policy evaluation submodule, and the business cost score is calculated by the policy evaluation submodule based on the technical investment, human resource costs, and performance losses required for policy implementation.

[0156] Step 5: Strategy implementation and feedback data collection.

[0157] The suggested strategy is sent to the object to be tested, and feedback data is collected after the object to be tested executes the suggested strategy.

[0158] Step 6: Iterative optimization of machine learning models, pre-set intelligent agents, and knowledge graphs.

[0159] The machine learning model, pre-set intelligent agent, and knowledge graph are iteratively optimized based on feedback data.

[0160] In this embodiment, a rigid chain of "data input → structured parsing → feature extraction → dynamic scoring → strategy generation → feedback optimization" is used to transform multimodal data into machine-understandable structured knowledge. Knowledge graphs are used to model the association between "data-processing-regulation," solving the problems of "data fragmentation and weak association" in traditional PIA. Based on the association features of the knowledge graph, an artificial intelligence dynamic scoring algorithm is used to identify risk types and score them in real time. A reinforcement learning model generates adaptive strategies to solve the problems of "risk lag, rigid scoring, and strategy generalization." The effectiveness of strategy implementation (such as the degree of risk reduction and changes in business costs) and human verification results are collected to optimize the parameters of the knowledge graph and machine learning model, enabling continuous capability upgrades. This accurately characterizes the complexity of actual risks, solving the rigid problem of "government encrypted storage of ID numbers and e-commerce plaintext storage being judged as high-risk," reducing the misjudgment rate of high-risk and the missed judgment rate of low-risk, and reducing unnecessary compliance costs.

[0161] This application also provides a compliance risk detection device, see [link to relevant documentation]. Figure 11 The device includes:

[0162] The data acquisition module 1110 is used to acquire the business data of the object to be tested and the legal data involved in the business of the object to be tested; the business data is the data related to the object to be tested during the processing of the business of the object to be tested; the legal data is the legal documents and / or regulatory documents that need to be met when processing the business of the object to be tested.

[0163] The knowledge graph generation module 1120 is used to generate a knowledge graph based on the business data and the regulatory data, wherein the knowledge graph represents the relationship between the business data and the regulatory data.

[0164] The feature extraction module 1130 is used to extract features from the knowledge graph to obtain risk feature data, wherein the risk feature data is data in the knowledge graph that can characterize the risks existing in the business data;

[0165] The risk prediction module 1140 is used to input the risk feature data into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

[0166] The compliance risk detection device provided in this application embodiment can uncover the inherent relationship between business data and regulatory data by establishing a knowledge graph. By inputting the risk feature data extracted from the knowledge graph into a pre-trained machine learning model, the pre-trained machine learning model can output the risk assessment result corresponding to the object to be detected based on the inherent relationship between the business data and the regulatory data. This can reduce the reliance on the professional ability of compliance personnel, thereby reducing the impact of individual differences on the assessment efficiency and accuracy in the compliance risk detection process, making the detection of the object to be detected more objective. Furthermore, through the above process, automatic detection of compliance risks is also achieved, reducing the manual cost in the compliance risk detection process and improving detection efficiency.

[0167] In one possible implementation, the business data includes structured business data and unstructured business data; the unstructured business data includes business codes, and the map generation module 1120 includes:

[0168] The conversion submodule is used to convert the business code into an abstract syntax tree, wherein the abstract syntax tree includes multiple data processing link entities;

[0169] The first entity recognition submodule is used to identify the data processing link entities of the abstract syntax tree and obtain the first entity relationship, wherein the first entity relationship represents the association between the first data entity and the processing entity in the business code, and the processing entity represents the entity name of the way to process the first data entity;

[0170] The second entity recognition submodule is used to perform entity recognition on the structured business data to obtain the second data entity in the structured business data;

[0171] The relationship extraction submodule is used to identify data entities and extract entity relationships from the regulatory data to obtain a second entity relationship, wherein the second entity relationship represents the association between a third data entity in the regulatory data and a regulatory entity; the regulatory entity is an entity term representing the regulatory requirement.

[0172] The knowledge graph generation submodule is used to establish a knowledge graph representing the association relationship between the second data entity, the processing entity, and the regulatory entity based on the second data entity, the first entity relationship, and the second entity relationship.

[0173] In one possible implementation, the relation extraction submodule is specifically used for:

[0174] The regulatory data is identified by using a pre-trained risk entity identification model to obtain the third data entity of the regulatory data.

[0175] A pre-trained relation extraction model is used to extract relation entities from the regulatory data to obtain the second entity relation of the regulatory data.

[0176] In one possible implementation, the risk prediction module 1140 includes:

[0177] The risk prediction submodule is used to input the risk feature data into a pre-trained machine learning model to obtain the risk type and risk score output by the pre-trained machine learning model.

[0178] The correction submodule is used to correct the risk score to obtain the risk level of the object to be detected.

[0179] The correction submodule is specifically used for:

[0180] Based on the preset correspondence between industry correction coefficients and industry types, the first industry correction coefficient of the industry in which the object to be tested is located is determined; wherein, the industry correction coefficient is a preset coefficient for correcting the risk level of different types of industries;

[0181] Based on the preset correspondence between processing entities and processing entity correction values, the first processing entity correction value corresponding to the processing entity in the knowledge graph is determined; the processing entity correction value represents the correction value for the risk score when the processing method corresponding to the processing entity is used for processing.

[0182] The risk score of the object to be detected is corrected using the first industry correction coefficient and the first processing entity correction value to obtain the risk level of the object to be detected.

[0183] In one possible implementation, the device further includes:

[0184] The risk handling rule determination module is used to determine the risk handling rule corresponding to the risk type of the object to be detected based on the preset correspondence between risk types and risk handling rules.

[0185] The strategy generation module is used to generate a suggested strategy using a preset intelligent agent based on the risk handling rules corresponding to the risk type of the object to be detected, the risk type, and the risk level. The suggested strategy is a strategy recommended for the risk type corresponding to the object to be detected, and the suggested strategy includes a processing entity and legal basis.

[0186] In one possible implementation, the device further includes:

[0187] The feedback data acquisition module is used to acquire feedback data of the suggested strategy, wherein the feedback data includes a risk level change value and a strategy effectiveness score. The risk level change value is the difference between the risk score of the object to be tested before implementing the suggested strategy and the risk score after implementing the suggested strategy. The strategy effectiveness score is calculated based on the risk level change value and the total number of pre-divided risk levels.

[0188] The reward function correction value update module is used to update the reward function correction value of the preset agent according to the policy effectiveness score, wherein the reward function correction value is a numerical value representing the correction of the reward of the preset agent;

[0189] The feature weight update module is used to update the feature weights of the target features in the machine learning model according to the risk level change value, wherein the target features are the features corresponding to the processing entity of the suggested strategy;

[0190] The knowledge graph update module is used to add nodes of entities processed in the proposed strategy to the knowledge graph based on the effectiveness score of the strategy, and to update the weight of the nodes corresponding to the legal basis of the proposed strategy in the knowledge graph.

[0191] This application also provides an electronic device, such as... Figure 12 As shown, it includes a processor 1201, a communication interface 1202, a memory 1203, and a communication bus 1204. The processor 1201, communication interface 1202, and memory 1203 communicate with each other via the communication bus 1204.

[0192] Memory 1203 is used to store computer programs;

[0193] The processor 1201, when executing the program stored in the memory 1203, implements any of the compliance risk detection methods described in this application.

[0194] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0195] The communication interface is used for communication between the aforementioned terminal and other devices.

[0196] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0197] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0198] In another embodiment provided in this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements any of the compliance risk detection methods described in the above embodiments.

[0199] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the compliance risk detection methods described in the above embodiments.

[0200] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0201] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0202] The various embodiments in this specification are described in a related manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other.

[0203] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A compliance risk detection method, characterized in that, The method includes: Obtain the business data of the object to be tested and the regulatory data related to the business of the object to be tested; the business data is the data related to the object to be tested during the processing of the business of the object to be tested; the regulatory data is the legal documents and / or regulations that need to be met when processing the business of the object to be tested. A knowledge graph is generated based on the business data and the regulatory data, wherein the knowledge graph represents the relationship between the business data and the regulatory data; Feature extraction is performed on the knowledge graph to obtain risk feature data, which is data in the knowledge graph that can characterize the risks existing in the business data; The risk feature data is input into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

2. The method according to claim 1, characterized in that, The business data includes structured business data and unstructured business data; the unstructured business data includes business codes; and the step of generating a knowledge graph based on the business data and the regulatory data includes: The business code is converted into an abstract syntax tree, wherein the abstract syntax tree includes multiple data processing link entities; Identify the data processing link entities of the abstract syntax tree to obtain a first entity relationship, wherein the first entity relationship represents the association between the first data entity and the processing entity in the business code, and the processing entity represents the entity name of the method of processing the first data entity; Entity recognition is performed on the structured business data to obtain the second data entity in the structured business data; The regulatory data is subjected to data entity identification and entity relationship extraction to obtain a second entity relationship, wherein the second entity relationship represents the association between the third data entity of the regulatory data and the regulatory entity; the regulatory entity is an entity term representing the regulatory requirement. Based on the second data entity, the first entity relationship, and the second entity relationship, a knowledge graph representing the association relationships between the second data entity, the processing entity, and the regulatory entity is established.

3. The method according to claim 2, characterized in that, The step of performing data entity identification and entity relationship extraction on the regulatory data to obtain the second entity relationship includes: The regulatory data is identified by using a pre-trained risk entity identification model to obtain the third data entity of the regulatory data. A pre-trained relation extraction model is used to extract relation entities from the regulatory data to obtain the second entity relation of the regulatory data.

4. The method according to claim 1, characterized in that, The step of inputting the risk feature data into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected includes: The risk feature data is input into a pre-trained machine learning model to obtain the risk type and risk score output by the pre-trained machine learning model. The risk score is corrected to obtain the risk level of the object to be tested.

5. The method according to claim 4, characterized in that, The step of correcting the risk score to obtain the risk level of the object to be detected includes: Based on the preset correspondence between industry correction coefficients and industry types, the first industry correction coefficient of the industry in which the object to be tested is located is determined; wherein, the industry correction coefficient is a preset coefficient for correcting the risk level of different types of industries; Based on the preset correspondence between processing entities and processing entity correction values, the first processing entity correction value corresponding to the processing entity in the knowledge graph is determined; the processing entity correction value represents the correction value for the risk score when the processing method corresponding to the processing entity is used for processing. The risk score of the object to be detected is corrected using the first industry correction coefficient and the first processing entity correction value to obtain the risk level of the object to be detected.

6. The method according to claim 5, characterized in that, The method further includes: Based on the pre-defined correspondence between risk types and risk handling rules, determine the risk handling rules corresponding to the risk types of the object to be detected; Based on the risk handling rules corresponding to the risk type of the object to be detected, the risk type, and the risk level, a suggested strategy is generated using a preset intelligent agent. The suggested strategy is a strategy recommended for the risk type corresponding to the object to be detected, and the suggested strategy includes a processing entity and legal basis.

7. The method according to claim 6, characterized in that, The method further includes: Obtain feedback data for the suggested strategy, wherein the feedback data includes a risk level change value and a strategy effectiveness score, the risk level change value being the difference between the risk score of the object to be tested before implementing the suggested strategy and the risk score after implementing the suggested strategy; the strategy effectiveness score is calculated based on the risk level change value and the total number of pre-divided risk levels; The reward function correction value of the preset agent is updated according to the policy effectiveness score, wherein the reward function correction value is a numerical value representing the correction of the reward of the preset agent; The feature weights of the target features in the machine learning model are updated according to the risk level change value, wherein the target features are the features corresponding to the processing entity of the suggested strategy; Based on the effectiveness score of the strategy, nodes representing entities processed by the proposed strategy are added to the knowledge graph, and the weights of the nodes corresponding to the legal basis of the proposed strategy are updated in the knowledge graph.

8. A compliance risk detection device, characterized in that, The device includes: The data acquisition module is used to acquire the business data of the object to be tested and the regulatory data related to the business of the object to be tested; the business data is the data related to the object to be tested during the processing of the business of the object to be tested; the regulatory data is the legal documents and / or regulations that need to be met when processing the business of the object to be tested. The knowledge graph generation module is used to generate a knowledge graph based on the business data and the regulatory data, wherein the knowledge graph represents the relationship between the business data and the regulatory data; The feature extraction module is used to extract features from the knowledge graph to obtain risk feature data, wherein the risk feature data is data in the knowledge graph that can characterize the risks existing in the business data; The risk prediction module is used to input the risk feature data into a pre-trained machine learning model to obtain a risk assessment result corresponding to the object to be detected.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; The processor, when executing a program stored in memory, implements the compliance risk detection method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the compliance risk detection method according to any one of claims 1-7.

Images